# Standalone hosting (module served directly)
Content-Security-Policy: default-src 'none'; script-src 'sha256-XzPtDDjVYDB3dLigQAp0kD+cZ/exJNbldcAGJ9HVRig='; style-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'self'

# SCORM hosting (LMS frames the module from another origin)
Content-Security-Policy: default-src 'none'; script-src 'sha256-XzPtDDjVYDB3dLigQAp0kD+cZ/exJNbldcAGJ9HVRig='; style-src 'unsafe-inline'; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors https://YOUR-LMS-DOMAIN

# The script hash changes every time you edit the config block. Recompute with:
#   printf '%s' "$(sed -n '/<script>/,/<\/script>/p' index.html | sed '1d;$d')" | openssl dgst -sha256 -binary | openssl base64
